MalwareTechnologyInformationRansomwareContiLocker TeamContilockerData ExfiltratedData EncryptedRansom DemandedCustomer Data InvolvedGovernment IDIdentity (basic)EmploymentMediumContained

ExaGrid Systems, Inc.

bd_9e4da439f5bc9ccd · schema v1 · pii pii-v1

Severity

Medium

Discovered

Apr 29, 2021

Filed

May 13, 2021

To disclose

14 days

Affected

29state residents only

Linked

4 filings

Confidence

66%

Full breach record for ExaGrid Systems, Inc. →

ExaGrid Systems, Inc. notified the New Hampshire Attorney General of a ransomware incident involving the ContiLocker Team. The attack occurred around April 28, 2021, and was discovered on April 29, 2021. The threat actor encrypted files and exfiltrated data, demanding ransom. Approximately 29 New Hampshire residents were potentially affected, primarily through employee HR records containing SSNs and PII. ExaGrid engaged Kivu Consulting for forensics, reported to the FBI, and implemented MFA and password resets.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 14 days

Apr 28, 2021

Begins

Apr 29, 2021

Discovered

May 13, 2021

Filed

vs. sector median

17 wks faster

This filing is one of 4 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_1733b65999dbe00f2021-05-14 · +1dCandidate
Massachusetts State AGbd_376295fd22abd0102021-05-14 · +1dVerified
Indiana State AGbd_e8bb1c6768a595232021-05-14 · +1dVerified

Name: Freeman, Mathis & Gary, LLP
norm: freeman mathis gary

Name: ExaGrid Systems, Inc.
norm: exagrid systems
Industry: Technologyllm

Discovered: Apr 29, 2021
Breach occurred: Apr 28, 2021
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: May 14, 2021
Affected individuals: 29state-resident count only
Data types: Government IDIdentity (basic)Employment
Data elements: Social Security numberDate of birth
Attack vector: Ransomware· ContiLocker Team
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 ChannelT1486 Data Encrypted for Impact
Threat actor: ContiLocker TeamExternalFinancial
Regulator citations: Reported the incident to the Federal Bureau of Investigation

During the incident: Retained the consulting firm Kivu Consulting, Inc. (“Kivu”) to address the incident, including by conducting a forensic investigation
Immediately took its servers offline
Began work to remove the ransomware from its systems
Reported the incident to its insurer
Engaged the services of the law firm Freeman, Mathis & Gary, LLP
Engaged the services of third-party digital forensic analysis and negotiations company, Kivu
Reported the incident to the Federal Bureau of Investigation
Changes made: Review of its Written Information Security Plan (“WISP”) to determine whether revisions are necessary
Introduction of multi-factor authentication for use of its network
Requiring each employee to change their network access password before getting back on the network
Bringing up its network with two factor authentication
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 14 days(14 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

New Hampshire State AGMay 13 · first · this page

Maine State AG+1d

Massachusetts State AG+1d

Indiana State AG+1d

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/exagrid-systems-20210513.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: May 13, 2021
Raw hash: b22ed1710e85858e0274d23b04c56bd9ae59496de85e16c6cef7f8aca7f4a012

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityFreeman, Mathis & Gary, LLP

Victim entityExaGrid Systems, Inc.

Incidentdiscovered Apr 29, 2021

Stated responseRetained the consulting firm Kivu Consulting, Inc. (“Kivu”) to address the incident, including by conducting a forensic investigation

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov